About this plugin
The plugin is an addon to the OpenID Connect Generic plugin which authenticates a user on each site.
Single sign-on. The plugin performs an OpenID Connect authorization against your provider. If the provider session exists, the visitor is signed in with no click and no password prompt.
Single logout. If you logout on a site you are logged out of them all. This happens through a signed top-level redirect chain that visits each configured site in turn and
ends at your provider’s end-session endpoint.
Order history. The sites without WooCommerce can display a signed-in customer’s order history with the [cross_site_orders] shortcode.
Design notes
This plugin deliberately does not replicate users, passwords, or orders between
sites. Your identity provider is the source of truth for identity; the site with WooCommerce is the source of truth for orders.
Roles and sign-on
By default, silent authentication is disabled for administrators to prevent the exploitation of hijacked provider sessions; however, administrative access to the plugin remains fully available. If your organization requires administrative roles to be included in Single Sign-On (SSO), you can modify this behavior using the LS_SSO_BLOCK_SILENT_ROLES constant (configured as a comma-separated list of role slugs, or left empty to permit all roles). Alternatively, you can utilize the ls_sso_block_silent_roles filter.
Requirements
- The OpenID Connect Generic plugin, active and configured, on every participating site.
- An OpenID Connect provider (Auth0, Keycloak, Okta, Entra ID and others).
- HTTPS on every site.
- WooCommerce, on the store site only if you want order data.